/*     */ package com.zimbra.cs.account;
/*     */ 
/*     */ import com.zimbra.common.account.Key.AccountBy;
/*     */ import com.zimbra.common.service.ServiceException;
/*     */ import com.zimbra.common.util.EmailUtil;
/*     */ import com.zimbra.common.util.Log;
/*     */ import com.zimbra.common.util.StringUtil;
/*     */ import com.zimbra.common.util.ZimbraLog;
/*     */ import com.zimbra.cs.account.accesscontrol.Right;
/*     */ import java.util.Map;
/*     */ import java.util.Set;
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ public class DomainAccessManager
/*     */   extends AccessManager
/*     */ {
/*     */   public boolean isDomainAdminOnly(AuthToken at)
/*     */   {
/*  34 */     return (at.isDomainAdmin()) && (!at.isAdmin());
/*     */   }
/*     */   
/*     */   public boolean isAdequateAdminAccount(Account acct)
/*     */   {
/*  39 */     return (acct.getBooleanAttr("zimbraIsDomainAdminAccount", false)) || (acct.getBooleanAttr("zimbraIsAdminAccount", false));
/*     */   }
/*     */   
/*     */   public boolean canAccessAccount(AuthToken at, Account target, boolean asAdmin)
/*     */     throws ServiceException
/*     */   {
/*  45 */     if (!at.isZimbraUser()) {
/*  46 */       return false;
/*     */     }
/*  48 */     boolean isDomainTheSame = StringUtil.equal(at.getAccount().getDomainId(), target.getDomainId());
/*  49 */     if (!isDomainTheSame) {
/*  50 */       checkDomainStatus(target);
/*     */     }
/*     */     
/*  53 */     if ((asAdmin) && (at.isAdmin())) return true;
/*  54 */     if (isParentOf(at, target)) return true;
/*  55 */     if ((!asAdmin) || (!at.isDomainAdmin())) { return false;
/*     */     }
/*  57 */     if (target.getBooleanAttr("zimbraIsAdminAccount", false)) return false;
/*  58 */     return isDomainTheSame;
/*     */   }
/*     */   
/*     */   public boolean canAccessAccount(AuthToken at, Account target) throws ServiceException
/*     */   {
/*  63 */     return canAccessAccount(at, target, true);
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */   public boolean canAccessAccount(Account credentials, Account target, boolean asAdmin)
/*     */     throws ServiceException
/*     */   {
/*  77 */     if (credentials == null) {
/*  78 */       return false;
/*     */     }
/*  80 */     boolean isDomainTheSame = StringUtil.equal(credentials.getDomainId(), target.getDomainId());
/*  81 */     if (!isDomainTheSame) {
/*  82 */       checkDomainStatus(target);
/*     */     }
/*     */     
/*     */ 
/*  86 */     if ((asAdmin) && (credentials.getBooleanAttr("zimbraIsAdminAccount", false))) {
/*  87 */       return true;
/*     */     }
/*  89 */     if (isParentOf(credentials, target)) {
/*  90 */       return true;
/*     */     }
/*  92 */     if (!asAdmin) {
/*  93 */       return false;
/*     */     }
/*  95 */     if (target.getBooleanAttr("zimbraIsAdminAccount", false)) {
/*  96 */       return false;
/*     */     }
/*  98 */     if (isDomainTheSame) {
/*  99 */       return credentials.getBooleanAttr("zimbraIsDomainAdminAccount", false);
/*     */     }
/* 101 */     return false;
/*     */   }
/*     */   
/*     */   public boolean canAccessAccount(Account credentials, Account target) throws ServiceException
/*     */   {
/* 106 */     return canAccessAccount(credentials, target, true);
/*     */   }
/*     */   
/*     */   private boolean canAccessDomainInternal(AuthToken at, String domainName) throws ServiceException {
/* 110 */     if (at.isAdmin()) {
/* 111 */       return true;
/*     */     }
/* 113 */     if (!at.isDomainAdmin()) {
/* 114 */       return false;
/*     */     }
/* 116 */     return getDomain(at).getName().equalsIgnoreCase(domainName);
/*     */   }
/*     */   
/*     */   public boolean canAccessDomain(AuthToken at, String domainName) throws ServiceException
/*     */   {
/* 121 */     if (!at.isZimbraUser())
/* 122 */       return false;
/* 123 */     checkDomainStatus(domainName);
/* 124 */     return canAccessDomainInternal(at, domainName);
/*     */   }
/*     */   
/*     */   public boolean canAccessDomain(AuthToken at, Domain domain) throws ServiceException
/*     */   {
/* 129 */     if (!at.isZimbraUser())
/* 130 */       return false;
/* 131 */     checkDomainStatus(domain);
/* 132 */     return canAccessDomainInternal(at, domain.getName());
/*     */   }
/*     */   
/*     */   public boolean canAccessCos(AuthToken at, Cos cos) throws ServiceException
/*     */   {
/* 137 */     if (!at.isZimbraUser()) {
/* 138 */       return false;
/*     */     }
/* 140 */     if (at.isAdmin()) return true;
/* 141 */     if (!at.isDomainAdmin()) { return false;
/*     */     }
/* 143 */     String cosId = cos.getId();
/*     */     
/* 145 */     Domain domain = getDomain(at);
/* 146 */     Set<String> allowedCoses = domain.getMultiAttrSet("zimbraDomainCOSMaxAccounts");
/* 147 */     for (String c : allowedCoses) {
/* 148 */       String[] parts = c.split(":");
/* 149 */       if (parts.length == 2)
/*     */       {
/* 151 */         String id = parts[0];
/* 152 */         if (id.equals(cosId))
/* 153 */           return true;
/*     */       } }
/* 155 */     return false;
/*     */   }
/*     */   
/*     */ 
/*     */   public boolean canCreateGroup(AuthToken at, String groupEmail)
/*     */     throws ServiceException
/*     */   {
/* 162 */     return false;
/*     */   }
/*     */   
/*     */   public boolean canCreateGroup(Account credentials, String groupEmail)
/*     */     throws ServiceException
/*     */   {
/* 168 */     return false;
/*     */   }
/*     */   
/*     */   public boolean canAccessGroup(AuthToken at, Group group)
/*     */     throws ServiceException
/*     */   {
/* 174 */     return false;
/*     */   }
/*     */   
/*     */   public boolean canAccessGroup(Account credentials, Group group, boolean asAdmin)
/*     */     throws ServiceException
/*     */   {
/* 180 */     return false;
/*     */   }
/*     */   
/*     */   public boolean canAccessEmail(AuthToken at, String email) throws ServiceException
/*     */   {
/* 185 */     String[] parts = EmailUtil.getLocalPartAndDomain(email);
/* 186 */     if (parts == null) {
/* 187 */       throw ServiceException.INVALID_REQUEST("must be valid email address: " + email, null);
/*     */     }
/*     */     
/* 190 */     Account targetAcct = Provisioning.getInstance().get(Key.AccountBy.name, email, at);
/* 191 */     if ((targetAcct != null) && 
/* 192 */       (isParentOf(at, targetAcct))) {
/* 193 */       return true;
/*     */     }
/* 195 */     return canAccessDomain(at, parts[1]);
/*     */   }
/*     */   
/*     */   public boolean canModifyMailQuota(AuthToken at, Account targetAccount, long mailQuota) throws ServiceException
/*     */   {
/* 200 */     if (!canAccessAccount(at, targetAccount)) {
/* 201 */       return false;
/*     */     }
/* 203 */     return canSetMailQuota(at, targetAccount, mailQuota);
/*     */   }
/*     */   
/*     */   public static boolean canSetMailQuota(AuthToken at, Account targetAccount, long quota)
/*     */     throws ServiceException
/*     */   {
/* 209 */     if (at.isAdmin()) { return true;
/*     */     }
/* 211 */     Account adminAccount = Provisioning.getInstance().get(Key.AccountBy.id, at.getAccountId(), at);
/* 212 */     if (adminAccount == null) { return false;
/*     */     }
/*     */     
/* 215 */     long maxQuota = adminAccount.getLongAttr("zimbraDomainAdminMaxMailQuota", -1L);
/*     */     
/*     */ 
/* 218 */     if (maxQuota == 0L) {
/* 219 */       return true;
/*     */     }
/* 221 */     if ((maxQuota == -1L) || (quota == 0L) || (quota > maxQuota))
/*     */     {
/*     */ 
/*     */ 
/* 225 */       ZimbraLog.account.warn(String.format("invalid attempt to change quota: admin(%s) account(%s) quota(%d) max(%d)", new Object[] { adminAccount.getName(), targetAccount.getName(), Long.valueOf(quota), Long.valueOf(maxQuota) }));
/*     */       
/* 227 */       return false;
/*     */     }
/* 229 */     return true;
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */   public boolean canDo(AuthToken grantee, Entry target, Right rightNeeded, boolean asAdmin)
/*     */   {
/* 243 */     return false;
/*     */   }
/*     */   
/*     */   public boolean canDo(MailTarget grantee, Entry target, Right rightNeeded, boolean asAdmin)
/*     */   {
/* 248 */     return false;
/*     */   }
/*     */   
/*     */   public boolean canDo(String grantee, Entry target, Right rightNeeded, boolean asAdmin)
/*     */   {
/* 253 */     return false;
/*     */   }
/*     */   
/*     */   public boolean canGetAttrs(Account grantee, Entry target, Set<String> attrs, boolean asAdmin) throws ServiceException
/*     */   {
/* 258 */     return false;
/*     */   }
/*     */   
/*     */   public boolean canGetAttrs(AuthToken grantee, Entry target, Set<String> attrs, boolean asAdmin) throws ServiceException
/*     */   {
/* 263 */     return false;
/*     */   }
/*     */   
/*     */   public boolean canSetAttrs(Account grantee, Entry target, Set<String> attrs, boolean asAdmin) throws ServiceException
/*     */   {
/* 268 */     return false;
/*     */   }
/*     */   
/*     */   public boolean canSetAttrs(AuthToken grantee, Entry target, Set<String> attrs, boolean asAdmin) throws ServiceException
/*     */   {
/* 273 */     return false;
/*     */   }
/*     */   
/*     */   public boolean canSetAttrs(Account grantee, Entry target, Map<String, Object> attrs, boolean asAdmin) throws ServiceException
/*     */   {
/* 278 */     return false;
/*     */   }
/*     */   
/*     */   public boolean canSetAttrs(AuthToken grantee, Entry target, Map<String, Object> attrs, boolean asAdmin) throws ServiceException
/*     */   {
/* 283 */     return false;
/*     */   }
/*     */ }


/* Location:              /home/mint/zimbrastore.jar!/com/zimbra/cs/account/DomainAccessManager.class
 * Java compiler version: 7 (51.0)
 * JD-Core Version:       0.7.1
 */